← Injective (npm SDK supply-chain attack)reviewed 2026-10-21 · 22 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Injective (npm SDK supply-chain attack) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #18[disputed][awaiting moderator]in section: Detection, response, and remediation timeline
“The compromised version was downloaded approximately 300–310 times before removal, a small fraction of the package's typical weekly volume, and reporting attributes many of those downloads to automated bots, mirrors, or security scanners rather than active developer integrations.”
reviewerThe compromised version was downloaded approximately 300-310 times before removal.The page's own section states elsewhere that Injective 'deprecated' version 1.20.21 (correct, confirmed against the live npm registry), but this sentence says the 300-310 downloads occurred 'before removal.' No source reviewed, and no current registry state, supports an actual removal; the package was deprecated (flagged with a warning) but never pulled from the registry, and multiple outlets note the release artifacts remained downloadable afterward.Proposed correction (not yet applied)The compromised version was downloaded approximately 300–310 times before it was deprecated, a small fraction of the package's typical weekly volume, and reporting attributes many of those downloads to automated bots, mirrors, or security scanners rather than active developer integrations.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #10[partially supported][awaiting moderator]in section: Attack mechanism and payload
“Bleeping Computer and Socket similarly reported that the malware avoided install-time detection by only activating when key-generation functions were actually called, and batched stolen data over a two-second window before transmission to reduce network-traffic anomalies.”
reviewerBleeping Computer and Socket reported that the malware avoided install-time detection by only activating when key-generation functions were actually called, and batched stolen data over a two-second window before transmission.The runtime-only-activation claim is confirmed by both outlets. The two-second batching detail is true (StepSecurity, cited elsewhere in this same section, documents it directly) but BleepingComputer sources it to StepSecurity rather than reporting it itself, and Socket's own article does not mention batching at all, so attributing it to 'Bleeping Computer and Socket' overstates those two outlets' independent reporting of that specific detail.
confirmed
20 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“On July 8, 2026, a compromised maintainer GitHub account was used to publish a backdoored version of @injectivelabs/sdk-ts and 17 related npm packages, disguising a wallet-key-stealing payload as SDK usage telemetry.”
reviewerOn July 8, 2026, a compromised maintainer GitHub account was used to publish a backdoored version of @injectivelabs/sdk-ts and 17 related npm packages, disguising a wallet-key-stealing payload as SDK usage telemetry.Corroborated by StepSecurity's detailed commit timeline and The Hacker News; also consistent with BleepingComputer, Socket, Sourcetrail and CryptoBriefing coverage fetched independently. - #2[confirmed][no action needed]in the summary
“The malicious code was live for approximately 49 minutes before being reverted”
reviewerThe malicious code was live for approximately 49 minutes before being reverted.The 49-minute figure is well corroborated and used consistently throughout the page's own sections and timeline. - #3[confirmed][no action needed]in the summary
“Injective Labs stated no funds on the network were at risk and no user losses were confirmed.”
reviewerInjective Labs stated no funds on the network were at risk and no user losses were confirmed.Confirmed by the CEO quote and independently by Socket; a search for later reporting (through October 2026) turned up no update contradicting this. - #4[confirmed][no action needed]in the summary
“This incident is a software supply-chain compromise affecting an official npm SDK maintained by Injective Labs — it did not involve a vulnerability or exploit of the Injective blockchain protocol itself.”
reviewerThis incident is a software supply-chain compromise affecting an official npm SDK maintained by Injective Labs — it did not involve a vulnerability or exploit of the Injective blockchain protocol itself.Matches the explicit framing used by The Hacker News and StepSecurity. - #5[confirmed][no action needed]in section: Distinction: npm supply-chain attack, not a protocol exploit
“The attacker did not exploit the Injective blockchain, its consensus mechanism, or its smart contracts.”
reviewerThe attacker did not exploit the Injective blockchain, its consensus mechanism, or its smart contracts.No source reviewed suggests any on-chain exploit occurred. - #6[confirmed][no action needed]in section: Distinction: npm supply-chain attack, not a protocol exploit
“Reporting from StepSecurity and The Hacker News characterizes the event specifically as a software supply-chain attack against npm-distributed developer tooling, analogous to other npm account-takeover incidents affecting unrelated projects.”
reviewerReporting from StepSecurity and The Hacker News characterizes the event specifically as a software supply-chain attack against npm-distributed developer tooling, analogous to other npm account-takeover incidents affecting unrelated projects.Both cited sources support this characterization directly. - #7[confirmed][no action needed]in section: Attack mechanism and payload
“an attacker gained control of a maintainer account (identified in commit history as "thomasRalee") and pushed malicious code directly to the master branch of the sdk-ts repository, bypassing standard pull-request review”
reviewerAn attacker gained control of a maintainer account identified in commit history as 'thomasRalee' and pushed malicious code directly to the master branch of the sdk-ts repository, bypassing standard pull-request review.Directly confirmed against StepSecurity's commit-hash-level account. - #8[confirmed][no action needed]in section: Attack mechanism and payload
“The payload was disguised as "key derivation telemetry for SDK usage analytics" and was injected into wallet-construction functions, including PrivateKey.fromMnemonic() and PrivateKey.fromHex().”
reviewerThe payload was disguised as 'key derivation telemetry for SDK usage analytics' and was injected into wallet-construction functions, including PrivateKey.fromMnemonic() and PrivateKey.fromHex().Function names and disguise framing match the primary technical write-up. - #9[confirmed][no action needed]in section: Attack mechanism and payload
“the code allegedly captured BIP-39 seed phrases and private keys, base64-encoded them, and exfiltrated them via the X-Request-Id header of POST requests spoofed to resemble legitimate Injective gRPC-web traffic — using a lookalike domain (testnet.archival.chain.grpc-web.injective.network) obfuscated as a character-code array to evade static analysis”
reviewerThe code captured BIP-39 seed phrases and private keys, base64-encoded them, and exfiltrated them via the X-Request-Id header of POST requests spoofed to resemble legitimate Injective gRPC-web traffic, using a lookalike domain obfuscated as a character-code array to evade static analysis.Technical mechanism matches both the primary vendor write-up and independent press coverage closely. - #11[confirmed][no action needed]in section: Scope of propagation
“The malicious payload was published as version 1.20.21 of @injectivelabs/sdk-ts and, because the repository used a monorepo release train with pinned exact-version dependencies, automated CI publishing propagated the same tainted release to 17 additional @injectivelabs-scoped npm packages within minutes — 18 packages in total.”
reviewerThe malicious payload was published as version 1.20.21 of @injectivelabs/sdk-ts and propagated via pinned exact-version dependencies to 17 additional @injectivelabs-scoped npm packages, 18 packages in total.Consistent across all outlets reviewed. - #12[confirmed][no action needed]in section: Scope of propagation
“Reporting indicates the sdk-ts package normally receives roughly 50,000 weekly downloads and has 87 downstream npm dependents, whose cumulative download volume was cited at just over 112,000 per week, meaning the theoretical blast radius extended well beyond direct installers of the SDK to any project depending on it transitively.”
reviewerThe sdk-ts package normally receives roughly 50,000 weekly downloads and has 87 downstream npm dependents, whose cumulative download volume was cited at just over 112,000 per week.Both figures confirmed directly against the cited Sourcetrail article; the underlying Ox Security research blog could not be fetched (403) but is independently corroborated by this cited secondary source. - #13[confirmed][no action needed]in section: Detection, response, and remediation timeline
“Per StepSecurity's incident reconstruction, the malicious commit was added at 20:24 UTC on July 8, 2026; a version bump triggered automated publishing at 20:54 UTC; all 18 packages went live with the backdoored code between 20:59 and 21:00 UTC.”
reviewerThe malicious commit was added at 20:24 UTC on July 8, 2026; a version bump triggered automated publishing at 20:54 UTC; all 18 packages went live with the backdoored code between 20:59 and 21:00 UTC.Verified against the primary technical source's own commit-hash timeline. - #14[confirmed][no action needed]in section: Detection, response, and remediation timeline
“A revert commit removing the payload followed at 21:16 UTC, and clean version 1.20.23 was published across all affected packages between 21:47 and 21:49 UTC — roughly 49 minutes after the compromised version first went live.”
reviewerA revert commit removing the payload followed at 21:16 UTC, and clean version 1.20.23 was published across all affected packages between 21:47 and 21:49 UTC — roughly 49 minutes after the compromised version first went live.Times match the primary technical source precisely. - #15[confirmed][no action needed]in section: Detection, response, and remediation timeline
“Security firms Socket, Ox Security, and StepSecurity are credited with identifying the malicious release and prompting the response.”
reviewerSecurity firms Socket, Ox Security, and StepSecurity are credited with identifying the malicious release and prompting the response.Consistent across every outlet reviewed. - #16[confirmed][no action needed]in section: Detection, response, and remediation timeline
“Injective Labs deprecated version 1.20.21 on the npm registry and revoked the compromised account's access.”
reviewerInjective Labs deprecated version 1.20.21 on the npm registry and revoked the compromised account's access.Directly verified against the live npm registry, not just secondary reporting. - #17[confirmed][no action needed]in section: Detection, response, and remediation timeline
“CEO Eric Chen stated that "no funds on the network are at risk."”
reviewerCEO Eric Chen stated that 'no funds on the network are at risk.'Quote matches the cited source (case of the leading letter aside). - #19[confirmed][no action needed]in section: Detection, response, and remediation timeline
“No confirmed user fund losses have been reported in connection with this incident as of the most recent coverage reviewed.”
reviewerNo confirmed user fund losses have been reported in connection with this incident as of the most recent coverage reviewed.A search for coverage dated through October 2026 found no report of confirmed losses, so this remains accurate as of today. - #20[confirmed][no action needed]in section: Residual risk for developers and end users
“Security researchers advised that any credentials, mnemonics, or private keys processed by an application using @injectivelabs packages during the roughly 49-minute exposure window (July 8, 2026, approximately 20:59–21:49 UTC) should be treated as compromised and rotated, since the malicious code was designed specifically to intercept wallet secrets at the point of key generation or import.”
reviewerSecurity researchers advised that credentials, mnemonics, or private keys processed during the roughly 49-minute exposure window (July 8, 2026, approximately 20:59-21:49 UTC) should be treated as compromised and rotated.Advice and window times both corroborated. - #21[confirmed][no action needed]in the timeline
“Clean version 1.20.23 is published across all 18 affected packages and version 1.20.21 is deprecated on the npm registry, ending the exposure window at roughly 49 minutes (approx. 21:47-21:49 UTC).”
reviewerTimeline: clean version 1.20.23 is published across all 18 affected packages and version 1.20.21 is deprecated on the npm registry, ending the exposure window at roughly 49 minutes (approx. 21:47-21:49 UTC).Date and times confirmed against both the primary technical source and the live npm registry. - #22[confirmed][no action needed]in the timeline
“Security researchers and outlets including Socket, Ox Security, The Hacker News, and Bleeping Computer publish analyses of the attack; Injective Labs CEO Eric Chen states no network funds are at risk.”
reviewerTimeline: Security researchers and outlets including Socket, Ox Security, The Hacker News, and Bleeping Computer publish analyses of the attack on 2026-07-09; Injective Labs CEO Eric Chen states no network funds are at risk.Minor imprecision possible (some outlets' articles may be dated July 10 rather than July 9), but the entry aggregates multiple outlets' publication over a short window and is not meaningfully misleading.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.